View online: https://www.drupal.org/psa-2019-02-25

Date: 2019-February-25 Vulnerability:  Drupal 7 will reach end-of-life in November of 2021

Description:  Drupal 7 was first released in January 2011. In November 2021, after over a decade, Drupal 7 will reach end of life (EOL). (More information on why this date was chosen [1].) Official community support for version 7 will end, along with support provided by the Drupal Association on Drupal.org. This means that automated testing services for Drupal 7 will be shut down, and there will be no more updates provided by the Drupal Security Team.

When this occurs, Drupal 7 will be marked end-of-life in the update manager, which appears in the Drupal administrative interface. Updates, security fixes, and enhancements will no longer be provided by the community, but may be available on a limited basis from select commercial vendors.

If you have a site that is running on Drupal 7, now is the time to start planning the upgrade. Note that the transition from Drupal 8 to Drupal 9 will not be the significant effort that the transition from 7 to 8 was. In fact, the first release of Drupal 9 will be identical to the last release of Drupal 8, except with deprecated code removed and dependencies updated to newer versions. (See Plan for Drupal 9 [2] for more information on Drupal 9.)

What this means for your Drupal 7 sites is, as of November 2021:

* Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. * There will be no more core commits to Drupal 7. * The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. * All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. * On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. * After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. * Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. * Now is the time to start planning your migration to Drupal 8.

If, for any reason, you are unable to migrate to Drupal 8 or 9 by the time version 7 reaches end of life, there will be a select number of organizations that will provide Drupal 7 Vendor Extended Support (D7ES) for their paying clients. This program is the successor to the successful Drupal 6 LTS program. Like that program, it will be an additional paid service, fully operated by these organizations with some help from the Security Team.

The Drupal Association and Drupal Security Team will publish an announcement once we have selected the Drupal 7 Vendor Extended Support partners.

If you would like more information about the Drupal release cycle, consult the official documentation on Drupal.org. If you would like more information about the upcoming release of Drupal 9, join us at DrupalCon Seattle.

.... Information for organizations interested in providing commercial Drupal 7 Vendor Extended Support

Organizations interested in providing commercial Drupal 7 Vendor Extended Support to their customers *and* who have the technical knowledge to maintain Drupal 7 are invited to fill out the application for the Drupal 7 Vendor Extended Support team [3]. The application submission should explain why the vendor is a good fit for the program, and explain how they meet the requirements as outlined below.

Base requirements for this program include:

* You must have experience in the public issue queue supporting Drupal 7 core or Drupal 7 Modules. You should be able to point to a history of such contribution. One way to measure this is issue credits, but there are other ways. You must continue this throughout your enrollment in the program. If you have other ways to show your experience, feel free to highlight them. * You must make a commitment to the Security Team, the Drupal Association, and your customers that you will remain active in this program for 3 years. * As a partner, you must contribute to at least 20% of all Drupal 7 Vendor Extended Support module patches and 80% of D7ES core patches in a given year. (Modules that have been moved into core in Drupal 8 count as part of core metrics in Drupal 7) . * Any organization involved in this program must have at least 1 member on the Drupal Security Team for at least 3 months prior to joining the program and while a member of the program. (See How to join the Drupal Security Team [4] for information.) This person will need a positive evaluation of their contributions from the Security Working Group. * Payment of an Drupal 7 Vendor Extended Support annual fee for program participation is required (around $3000 a year). These fees will go to communication tools for the Drupal 7 Vendor Extended Support vendors and/or the greater community. * Payment of a $450 application fee is required. * Your company must provide paid support to Drupal 7 clients. This program is not for companies that don't provide services to external clients. Application review process:

1) We will confirm that each vendor meets the requirements outlined above and is a good fit for the program. 2) If the Security Working Group does not think you are a good fit, we will explain why and decline your application. If you are rejected, you are able to reapply. Most rejections will be due to Organizations not having enough ongoing contribution to Drupal 7 and Organizations not having a Drupal Security Team member at their organization. 3) The Drupal Association signs off on your participation in the program. 4) If you are accepted, you will be added to the Drupal 7 Vendor Extended Support vendor mailing list. 5) The Security Working Group will do a coordinated announcement with the vendors to promote the program.

If you have any questions you can email d7es at drupal.org

[1] https://www.drupal.org/blog/drupal-7-8-and-9 [2] https://www.drupal.org/blog/plan-for-drupal-9 [3] https://www.surveymonkey.com/r/D7ES [4] https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security-...